CVE-2026-43910

Executive Summary

CVE-2026-43910 is a high-severity vulnerability in the Appium Java Client (8.2.1 up to 10.1.0). When the directConnect(true) feature is enabled, the AppiumCommandExecutor.setDirectConnect() method processes directConnectHost, directConnectPort, and directConnectPath from the server’s NEW_SESSION response without adequate validation—only checking that the protocol is HTTPS. This allows a rogue or compromised Appium server to redirect all subsequent session traffic to an arbitrary destination, leading to full interception of test traffic and enabling server-side request forgery (SSRF) pivots to internal hosts. Attackers can leverage this to access cloud metadata endpoints (e.g., IMDS) and steal credentials.

Affected Ecosystem: This vulnerability resides in a Java library distributed via Maven Central and GitHub Packages. As a Java client library, supply chain risks include dependency confusion or malicious releases that exploit this flaw.

Supply Chain & Package Security

• Maven Central – Artifact io.appium:java-client. Version range 8.2.1 to 10.1.0 are vulnerable.
• GitHub Packages – Same artifact may be mirrored.
• Risk: If a developer pulls a compromised version or their Appium server is rogue, the client can be weaponized against internal networks.
• Mitigation: Pin dependency to >=10.1.1, verify checksums, and never trust directConnect responses from untrusted servers.

CVSS Breakdown & Threat Level

• Base Score: 8.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: High
• Availability: None
• Impact: An attacker controlling the Appium server can redirect all subsequent WebDriver commands (e.g., element interaction, screenshots) to an attacker‑controlled host, exfiltrate data, and pivot to internal services (e.g., cloud metadata endpoints).

Threat Level: Critical in environments where Appium servers are accessible from potentially untrusted networks.

Deep Dive & Mechanics

The vulnerability lies in AppiumCommandExecutor.setDirectConnect():

1. Upon a successful NEW_SESSION response, the client parses three fields: directConnectHost, directConnectPort, and directConnectPath.
2. Validation is minimal—only that the protocol in the constructed URL is https.
3. The client then rebuilds its base URL for all subsequent requests (e.g., session commands) using these attacker‑controlled values.
4. No IP allowlist or hostname verification is performed, allowing redirection to arbitrary internal IPs (e.g., 169.254.169.254 for cloud metadata) or attacker‑owned hosts.

Attack Flow:

• Attacker sets up a malicious Appium server (or compromises a legitimate one).
• Victim client connects and performs new session.
• Malicious server responds with directConnectHost=169.254.169.254, directConnectPort=80, directConnectPath=/latest/meta-data/.
• All subsequent commands are sent to the IMDS endpoint, returning instance credentials.
• The attacker can also intercept and modify test commands/responses.

Vulnerable vs. Patched Code

Vulnerable (before 10.1.1):

// Simplified vulnerable version
public void setDirectConnect(DirectConnect directConnect) {
    if (directConnect.isDirectConnect()) {
        URLBuilder urlBuilder = new URLBuilder()
            .setProtocol("https")
            .setHost(directConnect.getDirectConnectHost())
            .setPort(directConnect.getDirectConnectPort())
            .setPath(directConnect.getDirectConnectPath());
        this.baseUrl = urlBuilder.build();  // No host validation
    }
}

Patched (10.1.1):

// Patched version (conceptual)
public void setDirectConnect(DirectConnect directConnect) {
    if (directConnect.isDirectConnect()) {
        URLBuilder urlBuilder = new URLBuilder()
            .setProtocol("https")
            .setHost(directConnect.getDirectConnectHost());
        // Added hostname validation
        if (!isAllowedHost(urlBuilder.getHost())) {
            throw new SecurityException("Direct connect host not allowed: " + urlBuilder.getHost());
        }
        urlBuilder.setPort(directConnect.getDirectConnectPort())
                  .setPath(directConnect.getDirectConnectPath());
        this.baseUrl = urlBuilder.build();
    }
}

Key Differences:

• The patched version introduces an allowlist or resolves the host and rejects private IPs/cloud metadata ranges.
• Also validates port is not well‑known sensitive ports.
• See official commit: GitHub commit link.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites: Access to a non‑patched Appium Java Client or control over a network path where the client connects to a malicious server.

Lab Setup:

1. Set up a rogue Appium server (e.g., using a custom Node.js server that returns forged directConnect fields).
2. Deploy a listener on attacker‑controlled host to receive redirected traffic.

Steps:

1. Prepare a malicious NEW_SESSION response:

   {
     "value": {
       "capabilities": {
         "directConnectHost": "169.254.169.254",
         "directConnectPort": 80,
         "directConnectPath": "/latest/meta-data/iam/security-credentials/"
       }
     }
   }
   

2. When the victim client connects, send this response.
3. All subsequent WebDriver commands will be sent to the AWS IMDS endpoint. Capture the returned credentials.

Variations:

• Redirect to an internal service (e.g., Redis, internal API) to perform SSRF.
• Use a public server to intercept test data.

Blue Team (Defender)

Detection:

• Monitor for unusual directConnectHost values in Appium server responses (e.g., private IPs, cloud metadata IPs).
• Audit network logs for traffic to internal IPs from the Appium client process.
• Use the Sigma rules below.

Prevention:

• Upgrade to version 10.1.1 or later.
• Implement network segmentation to restrict Appium clients from directly reaching cloud metadata endpoints.
• Use a proxy that validates redirections.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule (Detect vulnerable jar files)

rule CVE_2026_43910_Appium_Java_Client {
    meta:
        description = "Detects vulnerable Appium Java Client jar files (version 8.2.1 to 10.1.0)"
        author = "Valters IT"
        date = "2026-07-15"
        cve = "CVE-2026-43910"
    strings:
        $class = "AppiumCommandExecutor.class"
        $vuln_method = "setDirectConnect"
        $vuln_pattern = /directConnectHost|directConnectPort|directConnectPath/
        $ssl_only = /setProtocol\("https"\)/
    condition:
        all of ($class, $vuln_method, $vuln_pattern, $ssl_only)
}

Sigma Rule (Detect exploitation in network traffic)

title: CVE-2026-43910 Appium DirectConnect SSRF
id: d8f6e3a2-1b5c-4e7f-9a0d-6c2b8e1f4a7d
status: experimental
description: Detects outbound HTTP requests from Appium Java Client to cloud metadata endpoints or internal IPs
author: Valters IT
date: 2026-07-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-43910
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_ip:
            - '169.254.169.254'  # AWS, GCP, Azure
            - '100.100.100.200'  # Alibaba
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
        port:
            - 80
            - 443
    condition: selection
falsepositives:
    - Legitimate directConnect configuration to internal Appium grid
    - Administrative access to cloud metadata
level: high

Suricata Rule (IDS/IPS)

alert http $HOME_NET any -> $EXTERNAL_NET 80,443 (msg:"CVE-2026-43910 Potential Appium SSRP - directConnect to internal IP"; flow:to_server,established; content:"Host"; nocase; pcre:"/^(169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})$/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate

1. Upgrade all instances of io.appium:java-client to version 10.1.1 or later.
2. Validate any Appium server endpoints you connect to—ensure they are not compromised.
3. Disable directConnect if not required: disable directConnect(true) in client code.

Compensating Controls

• Network segmentation: Block outbound traffic from Appium client hosts to RFC1918 and cloud metadata IPs.
• Web application firewall: Inspect HTTP responses for suspicious directConnectHost values.
• Runtime monitoring: Use eBPF agents to detect unexpected outbound connections from Java processes.

Long‑Term

• Adopt dependency scanning (e.g., OWASP Dependency Check, Snyk) to flag vulnerable libraries.
• Enforce minimal trust: Appium clients should only communicate with known, vetted servers.

Valters IT – Cyber Threat Intelligence & DevSecOps